What Security+ practice questions need to test

Security+ practice questions are most useful when they resemble the decisions made by a security practitioner, rather than asking you to recall isolated definitions.

The exam is a timed, computer-based test with multiple-choice questions and performance-based questions (PBQs). Its questions are scenario-driven and cover areas including:

  • Threats and vulnerabilities
  • Security architecture and design
  • Security operations
  • Incident response
  • Governance, risk and compliance

A good question often gives you more information than you need. It may describe a business constraint, a technical symptom, an existing control and a desired outcome. You must identify the best answer in that context—not simply an answer that is technically true.

That means your practice should train four abilities:

  1. Identifying the actual problem in a scenario.
  2. Selecting the next or best action.
  3. Distinguishing closely related security terms.
  4. Rejecting answers that ignore scope, risk or operational constraints.

A repeatable method for answering questions

Use the same process for nearly every scenario question. A consistent method reduces the chance that you choose an impressive-sounding answer before understanding the problem.

1. Read the final question first

Look for the decision the question requires. Common wording includes:

  • What should the analyst do first?
  • Which control would best reduce the risk?
  • What is the most likely cause?
  • Which action should be taken next?
  • Which solution meets the requirements?

“First”, “best”, “most likely” and “next” are important. They limit the answer. If the question asks for the first incident-response action, a long-term architectural improvement may be sensible but still not correct.

2. Extract the objective and constraints

Before looking closely at the options, identify what the organisation is trying to achieve and what it cannot change.

For example, note whether the scenario requires:

  • Immediate containment rather than investigation
  • Access for contractors but not permanent accounts
  • Protection of data while it is being transmitted
  • Reduced lateral movement after a breach
  • Availability during a maintenance window
  • A control that works without changing an existing application

Constraints are not background decoration. An option that violates them should normally be eliminated even if it is otherwise secure.

3. Classify the problem

Ask which type of problem is being described:

  • A symptom, such as repeated failed logins
  • A root cause, such as stolen credentials
  • A missing preventive control
  • A missing detective control
  • An incident requiring response
  • A governance or compliance requirement
  • A design choice involving confidentiality, integrity or availability

This prevents you from treating a symptom while leaving the cause untouched.

4. Compare answers by risk reduction

When two options appear reasonable, prefer the one that reduces the stated risk most directly and proportionately. Security+ scenarios often reward practical risk reduction over a theoretically perfect design that cannot be implemented in the stated situation.

For instance, if compromised credentials are being used to access unrelated systems, a control that limits account permissions and network reach may be more relevant than simply requiring a more complex password.

5. Check the scope of each answer

Some options solve a different problem, operate at the wrong layer or are too broad for the scenario. Ask:

  • Does this control apply to the asset mentioned?
  • Does it address the stated threat?
  • Does it happen before, during or after the event?
  • Is it preventative, detective, corrective or compensating?
  • Does it fit the organisation’s constraints?

This final check is particularly useful when several answers are true in general.

Worked Security+ practice questions

The examples below are designed to practise the decision process. They are not official CompTIA questions and should not be treated as a prediction of the live exam.

Question 1: Limiting lateral movement

A company discovers that a standard user account was used to access a workstation in one department. The account should not have access to servers in other departments. Which control would best reduce the risk of similar lateral movement?

A. Increase the password length requirement for all users
B. Segment the network and restrict access between the relevant zones
C. Replace the affected workstation’s wallpaper
D. Increase the frequency of security awareness training

Best answer: B.

The immediate risk described is unnecessary movement from one network area to another. Segmentation, combined with appropriate access rules, limits the paths an attacker can use. The other choices may have security value but do not directly address the stated scope of access.

Lesson: Map the symptom to the control. Lateral movement points towards segmentation and restricted communications, not merely stronger authentication or awareness.

Question 2: Choosing the first response action

An analyst confirms that a server is communicating with a known malicious command-and-control address. The server is still connected to the production network. What should the analyst do first?

A. Publish a post-incident report
B. Rebuild every server in the environment
C. Isolate the affected server according to the incident-response procedure
D. Delete all logs to prevent further disclosure

Best answer: C.

The scenario describes an active compromise. Isolation is a containment action that can limit further damage while preserving the possibility of investigation. A report comes later, and rebuilding all servers is not justified by the information given. Deleting logs removes evidence.

Lesson: In “what should happen first?” questions, look for the action that controls immediate risk without destroying evidence or exceeding the scope of the incident.

Question 3: Least privilege for a contractor

A contractor needs access to one internal application for a limited project. The contractor does not need administrative functions and must not retain access after the project ends. Which approach best meets these requirements?

A. Create a shared administrator account
B. Grant permanent access to the whole internal network
C. Create an individual account with limited permissions and a defined expiry
D. Give the contractor a copy of an employee’s credentials

Best answer: C.

An individual account supports accountability. Limited permissions apply least privilege, while an expiry supports the time restriction. Shared or borrowed credentials make attribution and access removal more difficult.

Lesson: When a scenario gives a precise user, task and time period, look for individual identity, minimum necessary access and a reliable offboarding mechanism.

Question 4: Protecting data in transit

A team must protect sensitive information while it travels between a user’s browser and a web service. Which security property and control are most directly relevant?

A. Confidentiality using an appropriate encrypted transport
B. Availability using a larger storage array
C. Non-repudiation using a backup schedule
D. Integrity using a new office access badge

Best answer: A.

The question specifies sensitive information moving between endpoints. Confidentiality in transit is the main requirement, so an appropriate encrypted transport is the direct answer. Other controls may be useful elsewhere but do not match the stated need.

Lesson: Translate the wording into the relevant security objective before considering products or technologies.

Question 5: A control versus a root cause

A monitoring system reports repeated failed logins followed by a successful login from an unfamiliar location. Which action would best help determine whether the account has been compromised?

A. Review authentication and endpoint logs and investigate the successful session
B. Disable all monitoring systems
C. Change the organisation’s logo
D. Increase the size of the user’s mailbox

Best answer: A.

The evidence suggests a suspicious authentication sequence, but the analyst must investigate rather than assume a cause. Logs can help establish the source, timing, device and activity associated with the session.

Lesson: Do not confuse an alert with a confirmed root cause. Investigation should be based on relevant evidence.

How to practise multiple-choice questions

Do not measure progress only by the percentage correct. For each question, record the reasoning behind your choice.

A useful review table has these columns:

Field What to record
Topic For example, incident response, access control or architecture
Your answer The option you selected
Correct answer The option supported by the scenario
Miss type Knowledge, wording, prioritisation or careless reading
Key clue The phrase that should have guided you
Rule The principle to remember next time

Classify every miss. A knowledge miss means you did not know the concept. A wording miss means you overlooked a term such as “first” or “best”. A prioritisation miss means you chose a valid action that was not the most appropriate one. A careless-reading miss means you ignored a constraint.

These categories require different fixes. Knowledge gaps need targeted study. Wording and prioritisation gaps need more timed scenario practice. Careless-reading gaps need a slower extraction routine before reviewing the options.

After reviewing an answer, explain why each wrong option is wrong. This is more valuable than reading only the correct explanation because the exam may present several plausible controls with different scope or timing.

Preparing for performance-based questions

PBQs simulate real security tasks, so practise applying principles rather than memorising a definition. You may need to interpret a situation, configure or arrange items, select controls, or respond to evidence. The exact content of your live exam should be checked against the current official CompTIA information.

For PBQ preparation, practise these habits:

Start with the required outcome

Identify what the task is asking you to protect or achieve. Is it access restriction, secure network design, incident containment, service availability or evidence collection?

Apply secure defaults

Where the task involves permissions, routes, services or configurations, begin by denying unnecessary access and enabling only what the stated requirements need. Then check whether your changes break a required business function.

Separate essential from optional changes

Do not make every possible hardening change if the task asks for a specific outcome. Unnecessary changes can create new problems and may ignore the scope of the task.

Recheck dependencies

A secure setting is not useful if it prevents the required user, system or service from operating. Confirm that the selected control matches the asset, trust boundary and direction of access described.

Practise with a timer, but first aim for accurate reasoning. Once you can explain the decision, add time pressure. Review incomplete PBQs in the same way as wrong multiple-choice answers: identify the requirement you missed and the control that would have met it.

A weekly practice routine

A practical study cycle might look like this:

  • Session one: Learn one topic and write a short comparison of similar concepts.
  • Session two: Complete scenario questions without notes.
  • Session three: Review every answer, including correct guesses.
  • Session four: Practise a mixed set so you cannot predict the topic from the order.
  • Session five: Complete an applied task or PBQ-style exercise and review your decisions.

Keep a short “decision rules” document. Include rules such as “contain an active threat before long-term remediation” or “use the least privilege that satisfies the stated task”. Add rules only when a question exposes a recurring mistake.

Before the exam, confirm the current objectives, policies and exam information on CompTIA’s official website. Exam content and administrative details can change, so third-party question banks should be used as practice rather than as a source of guaranteed exam facts.

How MySummaries helps

MySummaries lets you build a revision board from your own Security+ notes, PDFs, slides or photographed handwritten material. From that board, you can generate flashcards for precise definitions, written mock exams for scenario practice, and audio lectures for review. Its live AI oral-exam practice can also help you explain why one control is the best answer, which is useful when your weakness is reasoning rather than recall.